By Moamen Basel, September 2026, 2 labs, about 20 minutes

Zcash from zero

The coin that proves every rule was followed and shows nobody.

This page is about the coin. Zcash keeps a Bitcoin shaped ledger and adds a second pool where a payment can prove it breaks no rule while saying nothing about who paid, who received, or how much moved. I build the machinery small enough to run in your browser: notes, seals, nullifiers, viewing keys. Two labs, real arithmetic, no libraries.

One boundary up front. How a proof can convince a verifier without revealing the secret behind it, why that is possible at all, is its own essay: zero knowledge from zero. The proof machinery itself is that essay's subject. This one stays on the money. When a spend needs a proof I will say so, mark where it sits, and move on.

01The privacy problem, restated

The Monero page in this notebook told one privacy story, hiding the real spender inside a crowd of decoys. Every Monero transaction signs with a ring of possible signers, so an observer staring at the chain sees many candidates and still walks off with no certainty about who spent. It works. It keeps working. The crowd is finite though, 16 signatures today, the whole chain someday if FCMP++ lands. Zcash grew out of a stranger question. What if a payment could prove it is legitimate while saying nothing at all about the people or the amounts? A proof that a secret exists, and not one digit of the secret itself.

The name for that object is a zero knowledge proof, and the whole essay about how such a thing can exist is the sibling page. For this page three facts are enough. The proofs are short, a few hundred bytes. They verify in milliseconds. And they leak nothing about what they prove, which is why a chain full of them can stay auditable and private at the same time.

A public ledger like Bitcoin's is public on purpose. Anyone can audit the money supply and every balance transfer ever made. Privacy work is the attempt to keep the audit and lose the surveillance. Zcash is the most radical attempt so far, and its failures teach as much as its wins.

02Haifa and Tel Aviv first

This has a history. A lot of the machinery came out of Israeli computer science departments, and I'm putting names and dates on that because the industry those labs started is still here.

The academic chain starts with Zerocoin, a 2013 paper from Johns Hopkins. A year later the direct ancestor of Zcash appeared. The Zerocash paper, published at the 2014 IEEE Symposium on Security and Privacy, has seven authors: Eli Ben Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer, and Madars Virza.

The affiliations matter. Ben Sasson was at the Technion in Haifa and Tromer was at Tel Aviv University. Chiesa and Virza were at MIT, while Garman, Green, and Miers were at Johns Hopkins. The founding research was Israeli and American together. That is the precise claim supported by the paper.

Shipping the coin was a different operation. Zcash launched in 2016 through the Zcash Company, now called Electric Coin Company. ECC's own transparency report identifies it as a United States company headquartered in Denver and incorporated in Delaware. Calling Zcash an Israeli company is false. Israeli researchers helped create the science. A US company shipped the coin.

In 2018, Ben Sasson and Chiesa joined Michael Riabzev and Uri Kolodny to found StarkWare Industries. StarkWare's official media kit lists those four founders, and its office is in Netanya, Israel. StarkWare is a separate Israeli company built around STARK technology. It is part of the same research lineage, not the company that created Zcash.

03How a shielded spend works

Zcash is two ledgers sharing one chain. The transparent side looks like Bitcoin. t addresses and amounts sit in the open. Anyone can audit them. The shielded pool is the other ledger, and that's where the strange part lives. Move funds in and they vanish from public view. The network still verifies every rule, because verification is what the proofs actually carry.

A payment inside the pool creates a note. That's a packed record holding the recipient's address, the amount, an optional memo line, and a random nonce called rho that makes this note unique in history even if every other field matches. The note never appears. What the chain sees is its commitment, a hash derived seal that binds the note's contents without showing them. It's a tamper evident envelope. You can tell it's sealed, but you can't read it while it's closed. Later you can confirm what sat inside. Two envelopes holding the same contents still look different because rho is in the hash. Every commitment joins a global Merkle tree. That tree of fingerprints lets you prove "my seal is one of the seals on the chain" in a handful of hash checks, and you never learn which seals anyone else owns.

Spending flips the machinery. To spend a note you publish two things. The first is a nullifier, a tag derived from your secret spending key and that note's rho. Each note produces exactly one nullifier, so publishing it twice is instantly visible, and that is the entire double spend defense. The second is a zk SNARK proof. The name stacks four claims. Zero knowledge means it leaks nothing. Succinct is the size, a few hundred bytes that verify in milliseconds. Non interactive is one message, no back and forth. Argument of knowledge is the part that says whoever built the proof actually holds the secret. The proof claims I know a note whose commitment sits in the tree, I own its spending key, the nullifier I published is the correct one for that note, and the values in and out balance. The chain checks the proof and records the nullifier. It appends fresh commitments for the recipient. It never learns the amount, and it never sees who sent or who received.

The pool has grown plumbing since 2016. The current shielded generation is called Orchard, live since the NU5 upgrade of 31 May 2022. It runs proof system halo 2. Addresses got unified in a way that lets one address receive across pools without the user thinking about it. Hand an auditor a viewing key and they can watch your incoming shielded activity without ever gaining the power to spend. You pick who sees. They still can't move funds. That door gets its own section, and its own lab, below.

Why the ceremony scared people

Older zk SNARKs had a catch. Before any proof could be made, someone had to generate a set of starting parameters, and that generation left behind a piece of toxic waste: a secret that, in the wrong hands, allows forging proofs, which for a currency means minting invisible money. The fix was ceremony. Many independent contributors each folded their own randomness into the parameters and then destroyed their secret, so the toxic waste survives only if every single participant is dishonest or compromised.

Zcash ran these rituals twice at scale. The 2016 Sprout setup had just six participants, a small enough circle that all six colluding, or all six being surveilled, was a scenario people honestly worried about back then. The 2018 Sapling setup did it properly. An open "Powers of Tau" first phase concluded in April 2018 with 88 participants, and a Sapling specific second phase accepted over 90 contributions by August 2018. One honest participant anywhere in the chain, and the waste is gone forever.

Then Zcash introduced a route around that catch. In 2019 Sean Bowe at the Electric Coin Company published Halo, a construction for recursive proofs with no trusted setup. Its descendant halo 2 shipped with Orchard in NU5. Since 31 May 2022, creating Orchard proofs has required no ceremony. The older Sprout and Sapling systems keep the assumptions of their original parameters, so this change applies specifically to Orchard.

04Seal a note, spend it twice

Four moves, one console. The note gets sealed, and only the seal boards the chain. The spend publishes a nullifier, and the ledger records it without learning anything. The replay publishes the identical nullifier, because it's the same note, and the network refuses it on sight. A second, different note produces a different nullifier and the network accepts it. Scroll through the console. Do the analyst's job. Match each nullifier to the commitment that birthed it. There's nothing to match on. That gap is what a zero knowledge proof stands in for, and in the real system that proof is a few hundred bytes you can check in milliseconds without learning the note.

05The viewing key door

Privacy coins collect a fair question. If nobody can see the money, how does anyone check anything? Zcash answers with a key hierarchy. Above the spending key sits a viewing key, and the split is enforced by the same mathematics that hides the notes. Hand the viewing key to an auditor or a tax office and they can read every note that arrives at your addresses. What they cannot do is spend. The read path and the spend path run on different secrets, and only one of them ever leaves your wallet.

Orchard inherits the Sapling design here. A spending key derives an incoming viewing key, and that viewing key derives the addresses you hand out. Notes travel encrypted under a key agreement between the sender and the address, so a viewer holding the viewing key can decrypt what arrived, recompute each note's seal, and confirm it in the commitment tree. The nullifier is the wall. It derives from the spending key together with the note's rho, so the viewer reads the seal but cannot produce the tag the ledger demands. Read without spend is not a policy promise. It is arithmetic.

The door gets used. Exchanges prove reserves, funds show auditors their inflows, and regulated custody keeps compliance somewhere better than the transparent pool, where the only disclosure setting is everything. Monero has its own view key split, so the idea is not a Zcash invention, but Zcash pairs it with the larger anonymity set. The cost is real too. A leaked viewing key is permanent, and the default key covers incoming notes only, while outgoing activity needs a separate, newer key that fewer wallets expose. You are trading a secret for an oversight channel, and the trade cannot be undone quietly.

Run it and watch the two powers separate. The auditor's key recomputes the sender's secret, unmasked, and the amount appears next to a seal that matches the leaf on chain. That is the entire audit. Then the auditor reaches for the nullifier and the arithmetic refuses. Same note, same rho, wrong key, and the forged tag names nothing the ledger will accept. The owner's key produces the real tag in one line. Reading and spending were never the same permission, and the boundary is not a permission check in some server. It is which exponent you hold.

06What the chain still shows

Zcash supports transparent and shielded activity on one chain. The protocol specification is explicit: transfers between transparent and shielded value pools reveal the amount crossing the boundary. A fully shielded Orchard transfer hides the addresses and amounts inside the pool. Privacy therefore depends on the path a wallet chooses, not only on the proof system.

The 31 May 2022 NU5 upgrade activated Orchard and moved Zcash to Halo, removing Orchard's need for a trusted setup. It also introduced unified addresses so wallets can present one address while choosing supported receiver types. That improves the default experience, but it does not make transparent transfers private or erase information already published.

07The honest scorecard

So who wins? Depends who is asking.

Against a stranger reading the chain, a fully shielded Zcash transfer reveals no sender, recipient, or amount. There are no decoys to classify. The transparent side is the counterweight. A user or wallet can still publish a Bitcoin like transfer, and crossing between value pools reveals the amount at the boundary. Monero makes privacy mandatory at the protocol layer. Bitcoin is the baseline the whole notebook starts from, and its essay draws that world at full size.

The auditability row is the honest cost of hiding. A transparent chain can audit supply by adding public values. Zcash verifies shielded value through proof soundness, while its transparent side remains directly auditable. The Monero page scores similar tradeoffs from Monero's side, including its ring signatures and FCMP++ work.

My verdict is narrower. Zcash built a strong privacy instrument, but users only receive its full protection inside the shielded path. Viewing keys make selective audits possible without granting spending power. Transparent transfers and pool crossings remain visible. The larger idea, proofs that reveal a fact without exposing the source data, continues in the zero knowledge essay.